samples/landlock: Add support for abstract UNIX socket scoping

The sandboxer can receive the character "a" as input from the
environment variable LL_SCOPE to restrict sandboxed processes from
connecting to an abstract UNIX socket created by a process outside of
the sandbox.

Example
=======

Create an abstract UNIX socket to listen with socat(1):
  socat abstract-listen:mysocket -

Create a sandboxed shell and pass the character "a" to LL_SCOPED:
  LL_FS_RO=/ LL_FS_RW=. LL_SCOPED="a" ./sandboxer /bin/bash

Note that any other form of input (e.g. "a:a", "aa", etc) is not
acceptable.

If the sandboxed process tries to connect to the listening socket, the
connection will fail:
  socat - abstract-connect:mysocket

Signed-off-by: Tahera Fahimi <fahimitahera@gmail.com>
Link: https://lore.kernel.org/r/d8af908f00b77415caa3eb0f4de631c3794e4909.1725494372.git.fahimitahera@gmail.com
[mic: Improve commit message, simplify check_ruleset_scope() with
inverted error code and only one scoped change, always unset environment
variable]
Signed-off-by: Mickaël Salaün <mic@digikod.net>

diff --git a/samples/landlock/sandboxer.c b/samples/landlock/sandboxer.c
index e8223c3e781ab85f9224c3bb416c7e2378e3a058..adbd7083673907f513041e589a46e039c633a127 100644 (file)
--- a/samples/landlock/sandboxer.c
+++ b/samples/landlock/sandboxer.c
@@ -14,6 +14,7 @@
 #include <fcntl.h>
 #include <linux/landlock.h>
 #include <linux/prctl.h>
+#include <linux/socket.h>
 #include <stddef.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -22,6 +23,7 @@
 #include <sys/stat.h>
 #include <sys/syscall.h>
 #include <unistd.h>
+#include <stdbool.h>
 
 #ifndef landlock_create_ruleset
 static inline int
@@ -55,6 +57,7 @@ static inline int landlock_restrict_self(const int ruleset_fd,
 #define ENV_FS_RW_NAME "LL_FS_RW"
 #define ENV_TCP_BIND_NAME "LL_TCP_BIND"
 #define ENV_TCP_CONNECT_NAME "LL_TCP_CONNECT"
+#define ENV_SCOPED_NAME "LL_SCOPED"
 #define ENV_DELIMITER ":"
 
 static int parse_path(char *env_path, const char ***const path_list)
@@ -184,6 +187,48 @@ out_free_name:
        return ret;
 }
 
+/* Returns true on error, false otherwise. */
+static bool check_ruleset_scope(const char *const env_var,
+                               struct landlock_ruleset_attr *ruleset_attr)
+{
+       char *env_type_scope, *env_type_scope_next, *ipc_scoping_name;
+       bool error = false;
+       bool abstract_scoping = false;
+
+       /* Scoping is not supported by Landlock ABI */
+       if (!(ruleset_attr->scoped & LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET))
+               goto out_unset;
+
+       env_type_scope = getenv(env_var);
+       /* Scoping is not supported by the user */
+       if (!env_type_scope || strcmp("", env_type_scope) == 0)
+               goto out_unset;
+
+       env_type_scope = strdup(env_type_scope);
+       env_type_scope_next = env_type_scope;
+       while ((ipc_scoping_name =
+                       strsep(&env_type_scope_next, ENV_DELIMITER))) {
+               if (strcmp("a", ipc_scoping_name) == 0 && !abstract_scoping) {
+                       abstract_scoping = true;
+               } else {
+                       fprintf(stderr, "Unknown or duplicate scope \"%s\"\n",
+                               ipc_scoping_name);
+                       error = true;
+                       goto out_free_name;
+               }
+       }
+
+out_free_name:
+       free(env_type_scope);
+
+out_unset:
+       if (!abstract_scoping)
+               ruleset_attr->scoped &= ~LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET;
+
+       unsetenv(env_var);
+       return error;
+}
+
 /* clang-format off */
 
 #define ACCESS_FS_ROUGHLY_READ ( \
@@ -208,7 +253,7 @@ out_free_name:
 
 /* clang-format on */
 
-#define LANDLOCK_ABI_LAST 5
+#define LANDLOCK_ABI_LAST 6
 
 int main(const int argc, char *const argv[], char *const *const envp)
 {
@@ -223,14 +268,15 @@ int main(const int argc, char *const argv[], char *const *const envp)
                .handled_access_fs = access_fs_rw,
                .handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP |
                                      LANDLOCK_ACCESS_NET_CONNECT_TCP,
+               .scoped = LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET,
        };
 
        if (argc < 2) {
                fprintf(stderr,
-                       "usage: %s=\"...\" %s=\"...\" %s=\"...\" %s=\"...\"%s "
+                       "usage: %s=\"...\" %s=\"...\" %s=\"...\" %s=\"...\" %s=\"...\" %s "
                        "<cmd> [args]...\n\n",
                        ENV_FS_RO_NAME, ENV_FS_RW_NAME, ENV_TCP_BIND_NAME,
-                       ENV_TCP_CONNECT_NAME, argv[0]);
+                       ENV_TCP_CONNECT_NAME, ENV_SCOPED_NAME, argv[0]);
                fprintf(stderr,
                        "Execute a command in a restricted environment.\n\n");
                fprintf(stderr,
@@ -251,15 +297,18 @@ int main(const int argc, char *const argv[], char *const *const envp)
                fprintf(stderr,
                        "* %s: list of ports allowed to connect (client).\n",
                        ENV_TCP_CONNECT_NAME);
+               fprintf(stderr, "* %s: list of scoped IPCs.\n",
+                       ENV_SCOPED_NAME);
                fprintf(stderr,
                        "\nexample:\n"
                        "%s=\"${PATH}:/lib:/usr:/proc:/etc:/dev/urandom\" "
                        "%s=\"/dev/null:/dev/full:/dev/zero:/dev/pts:/tmp\" "
                        "%s=\"9418\" "
                        "%s=\"80:443\" "
+                       "%s=\"a\" "
                        "%s bash -i\n\n",
                        ENV_FS_RO_NAME, ENV_FS_RW_NAME, ENV_TCP_BIND_NAME,
-                       ENV_TCP_CONNECT_NAME, argv[0]);
+                       ENV_TCP_CONNECT_NAME, ENV_SCOPED_NAME, argv[0]);
                fprintf(stderr,
                        "This sandboxer can use Landlock features "
                        "up to ABI version %d.\n",
@@ -327,6 +376,10 @@ int main(const int argc, char *const argv[], char *const *const envp)
                /* Removes LANDLOCK_ACCESS_FS_IOCTL_DEV for ABI < 5 */
                ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_IOCTL_DEV;
 
+               __attribute__((fallthrough));
+       case 5:
+               /* Removes LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET for ABI < 6 */
+               ruleset_attr.scoped &= ~LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET;
                fprintf(stderr,
                        "Hint: You should update the running kernel "
                        "to leverage Landlock features "
@@ -358,6 +411,9 @@ int main(const int argc, char *const argv[], char *const *const envp)
                        ~LANDLOCK_ACCESS_NET_CONNECT_TCP;
        }
 
+       if (check_ruleset_scope(ENV_SCOPED_NAME, &ruleset_attr))
+               return 1;
+
        ruleset_fd =
                landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
        if (ruleset_fd < 0) {